a0deed5f2baa13fc1a45a5f2a5edbd92603c4e769e9b0362b4657a27b31365ed

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 08:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2e5382063a02d458d93142dd2fc4b2d5_JaffaCakes118.html
Size

67KB
MD5

2e5382063a02d458d93142dd2fc4b2d5
SHA1

77451f646abdd027ec03c29c65e5cfcc18284aeb
SHA256

a0deed5f2baa13fc1a45a5f2a5edbd92603c4e769e9b0362b4657a27b31365ed
SHA512

920df48d90e38e7b9c0796a5f682c08d9272d1fd1a42ae09082e80b4a06a351b55b48026bdc3cc54ea9baede2c9ca2d56e31544d66b55763c52a65172795b7b2
SSDEEP

1536:cKkAtkAVckABKQJZkAgh3cr0Y8GNMxZPdJXxPxQckAn+SHvFSEwdhw3vrTRLB4lJ:ZkAtkAukAImZkAc3cr01GNMxZPdJXxPC

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3052	msedge.exe
3052	msedge.exe
5028	msedge.exe
5028	msedge.exe
3700	identity_helper.exe
3700	identity_helper.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 1312	5028	msedge.exe	81
PID 5028 wrote to memory of 1312	5028	msedge.exe	81
PID 5028 wrote to memory of 2968	5028	msedge.exe	82
PID 5028 wrote to memory of 2968	5028	msedge.exe	82
PID 5028 wrote to memory of 2968	5028	msedge.exe	82
PID 5028 wrote to memory of 2968	5028	msedge.exe	82
PID 5028 wrote to memory of 2968	5028	msedge.exe	82
PID 5028 wrote to memory of 2968	5028	msedge.exe	82
PID 5028 wrote to memory of 2968	5028	msedge.exe	82
PID 5028 wrote to memory of 2968	5028	msedge.exe	82
PID 5028 wrote to memory of 2968	5028	msedge.exe	82
PID 5028 wrote to memory of 2968	5028	msedge.exe	82
PID 5028 wrote to memory of 2968	5028	msedge.exe	82
PID 5028 wrote to memory of 2968	5028	msedge.exe	82
PID 5028 wrote to memory of 2968	5028	msedge.exe	82
PID 5028 wrote to memory of 2968	5028	msedge.exe	82
PID 5028 wrote to memory of 2968	5028	msedge.exe	82
PID 5028 wrote to memory of 2968	5028	msedge.exe	82
PID 5028 wrote to memory of 2968	5028	msedge.exe	82
PID 5028 wrote to memory of 2968	5028	msedge.exe	82
PID 5028 wrote to memory of 2968	5028	msedge.exe	82
PID 5028 wrote to memory of 2968	5028	msedge.exe	82
PID 5028 wrote to memory of 2968	5028	msedge.exe	82
PID 5028 wrote to memory of 2968	5028	msedge.exe	82
PID 5028 wrote to memory of 2968	5028	msedge.exe	82
PID 5028 wrote to memory of 2968	5028	msedge.exe	82
PID 5028 wrote to memory of 2968	5028	msedge.exe	82
PID 5028 wrote to memory of 2968	5028	msedge.exe	82
PID 5028 wrote to memory of 2968	5028	msedge.exe	82
PID 5028 wrote to memory of 2968	5028	msedge.exe	82
PID 5028 wrote to memory of 2968	5028	msedge.exe	82
PID 5028 wrote to memory of 2968	5028	msedge.exe	82
PID 5028 wrote to memory of 2968	5028	msedge.exe	82
PID 5028 wrote to memory of 2968	5028	msedge.exe	82
PID 5028 wrote to memory of 2968	5028	msedge.exe	82
PID 5028 wrote to memory of 2968	5028	msedge.exe	82
PID 5028 wrote to memory of 2968	5028	msedge.exe	82
PID 5028 wrote to memory of 2968	5028	msedge.exe	82
PID 5028 wrote to memory of 2968	5028	msedge.exe	82
PID 5028 wrote to memory of 2968	5028	msedge.exe	82
PID 5028 wrote to memory of 2968	5028	msedge.exe	82
PID 5028 wrote to memory of 2968	5028	msedge.exe	82
PID 5028 wrote to memory of 3052	5028	msedge.exe	83
PID 5028 wrote to memory of 3052	5028	msedge.exe	83
PID 5028 wrote to memory of 320	5028	msedge.exe	84
PID 5028 wrote to memory of 320	5028	msedge.exe	84
PID 5028 wrote to memory of 320	5028	msedge.exe	84
PID 5028 wrote to memory of 320	5028	msedge.exe	84
PID 5028 wrote to memory of 320	5028	msedge.exe	84
PID 5028 wrote to memory of 320	5028	msedge.exe	84
PID 5028 wrote to memory of 320	5028	msedge.exe	84
PID 5028 wrote to memory of 320	5028	msedge.exe	84
PID 5028 wrote to memory of 320	5028	msedge.exe	84
PID 5028 wrote to memory of 320	5028	msedge.exe	84
PID 5028 wrote to memory of 320	5028	msedge.exe	84
PID 5028 wrote to memory of 320	5028	msedge.exe	84
PID 5028 wrote to memory of 320	5028	msedge.exe	84
PID 5028 wrote to memory of 320	5028	msedge.exe	84
PID 5028 wrote to memory of 320	5028	msedge.exe	84
PID 5028 wrote to memory of 320	5028	msedge.exe	84
PID 5028 wrote to memory of 320	5028	msedge.exe	84
PID 5028 wrote to memory of 320	5028	msedge.exe	84
PID 5028 wrote to memory of 320	5028	msedge.exe	84
PID 5028 wrote to memory of 320	5028	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2e5382063a02d458d93142dd2fc4b2d5_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffff99546f8,0x7ffff9954708,0x7ffff9954718
  2⤵
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,7960034687630621244,2960249422900841955,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,7960034687630621244,2960249422900841955,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,7960034687630621244,2960249422900841955,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
  2⤵
  PID:320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7960034687630621244,2960249422900841955,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7960034687630621244,2960249422900841955,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7960034687630621244,2960249422900841955,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7960034687630621244,2960249422900841955,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7960034687630621244,2960249422900841955,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,7960034687630621244,2960249422900841955,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5608 /prefetch:8
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,7960034687630621244,2960249422900841955,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5608 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7960034687630621244,2960249422900841955,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7960034687630621244,2960249422900841955,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7960034687630621244,2960249422900841955,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7960034687630621244,2960249422900841955,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,7960034687630621244,2960249422900841955,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5024 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4336

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1952

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
2867861c3c2dd625df410784f5a8ce66

SHA1
a9e3b345861d446df1575177c18509831472eef0

SHA256
67f4efdeb7ae2a60de81e16fe2d7cad64ba35b175e3dd787776a1cc401d4df92

SHA512
f6a38e84b018dec532817f7a34b59f26d1883dcdd87d7fd15a5b9525f6242005b87f40035d32b6ff9bccd2782a3a2287925685bfac31885fce5bf6049509c79e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e2503cc6431ee86e7a4eab812b31040d

SHA1
bfb55d26193919b35985479fd1a7819eb7e62cc9

SHA256
1a694778559d0d72974fddf4ce08dc137cafe289889eba1a20c6ef58493d4369

SHA512
724ff96074380e39d05df938231becb26275453108f70afe82d418aa37636843d5b7fea3287861eee983623fa205ab49f0a2a7281148f81a7f70fb642044139c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
fc307b6f7a68a9ad1065b53f249ae720

SHA1
e9200c2fc5d8a2803f61a35b0403686dbbb4d2be

SHA256
e8ce06d6e5ceadc97aa74bc9788076b307886010b9808f8db0959057c8106d04

SHA512
205b2fe72a05c8d7d2aa5ceb2d62ec4897e922cc05912946f23e5e82dd0ee86aa21ef5e030a338686f4a44b3de3e19e9573b245e54f88c5766f66ebbe90275fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e8ab96ff5cc97a1d680a1269a22b96c8

SHA1
478d5d5989724acc14161455ad4b26bf564c4b12

SHA256
df227b5d6172a7c3909eb8efd479c143908c2dfc16d1d65268c45c7b628bc372

SHA512
b3733dfea0df557c703551086f3ea955d4fb6c8f07769e831bce9714baed95ad418614ffd2dac06d89183d2740e59ebd9c170320809b82f29b84b6d8d96ce728

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ef9802e5691238e871e9052d385d9819

SHA1
438cadf265aa7002dd8b27e4ac628f519efe3ded

SHA256
5862adf0bef10ce204702153a211ea8cef4b25de67c114a2e2663649395b542a

SHA512
fefc91ef31af6298ba9b243045b22adf537bf7203b57a78601c2f3faa382f5212abf1ff7d952f18bc7cd18388c20810608a53beab10c0910c2467b7ce4abb020

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
cb67246423b04677f934b6bfdd65846b

SHA1
f5c047c34dbca199781f63f3c6ae939f9dddb42a

SHA256
34862bc288e8d1496e4a1268114d68b8f51a7c10306ea2bf4377fd770313aa30

SHA512
e340def34705272ca0f53775fc0bee41d1259ee81e1f8764ec9f1ac8c66048f3ed3ab1084dbc859f7853e21ff7946ad46bc90771e83780ff2d88c5bbc55e85b1

Download Submit